https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:22:52.038841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33045 CVE-2026-33045 — Home Assistant has stored XSS in history-graphs 2026-10-02T12:22:52.040575+00:00

Affected: home-assistant core

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. Version 2026.01 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-46j8-vpx8-6p72 GHSA-46j8-vpx8-6p72 — Home Assistant has stored XSS in history-graphs 2026-10-02T12:22:52.040627+00:00

Affected: PyPI: homeassistant

### Summary The "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable to the same issue as CVE-2025-62172. <img width="431" height="334" alt="image" src="https://github.com/user-attachments/assets/84e0dfad-b986-4e84-ad0e-674c5da88582" /> This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue.

### Details

Another entity was found which displays the same behavior as in this issue: [CVE-2025-62172](https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m)

The History-graph card will sometimes display the name of the entity it is displaying, when the graph is shown as a line with values on the x and y axis. This appears to be vulnerable to Cross-Site scripting (_XSS_) as it does not have any output escaping or sanitization.

The PoC in this instance only shows HTML-injection in the form of the `<s>` -tag being rendered as strike through, but the vulnerability also allows for injecting arbitrary tags which execute JavaScript, like the example given in the PoC description below.

### PoC 1. Register a new sensor (or device) or change the name of an existing one, which provides a location 2. Change the name to something malicious, for example `test <img src=x onerror=alert(document.domain) />` For a new entity, it should work when setting the name. For old entities, go here: <img width="1300" height="411" alt="image" src="https://gi…